--- sourceDocument: Xanadu Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/governance-risk-compliance Release : - xanadu ft:locale : - en-US ft:publication_title : - Xanadu Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Impact categories and ratings # Impact categories and ratings {#ariaid-title1} * Release version: Xanadu * * Updated July 31, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Impact categories are the types of an impact that you can assess during a business impact analysis. The BCM administrator of an organization is responsible for defining the impact categories and the timeframe during which an organization may experience a downtime. This information is used to determine the recovery time objective and recovery point objective of the assets. ## Broad classification of the impact categories {#bia-impact-categories__section_yms_ksr_pxb} When a business service, process, or application experiences downtime due to a disruptive event, its impact can be classified in various broad categories: * Legal impact: Classified as an impact with legal implications such as a civil lawsuit or fines that result from a service disruption. * Regulatory impact: Classified as an impact due to a change in the existing regulation or the introduction of a new policy. * Reputation impact: Classified as an impact to the brand image and reputation of a company. * Revenue impact: Classified as an impact due to financial losses or low revenues. * Workforce impact: Classified as an impact of a disruptive event on the workforce. For example, a company experiences an increased attrition rate and low employee morale post the pandemic. {#bia-impact-categories__ul_cqg_psr_pxb} ## Impact categories in BCM {#bia-impact-categories__section_p1w_gng_cyb} With the BCM administrator role, you can view the impact categories that are installed with demo data and set up new impact categories in the Impact categories module of the BCM application. The following example shows the impact categories that are installed with demo data in an instance. ## Configuration of an impact category {#bia-impact-categories__id_bzx_rtg_cyb} The BCM administrators can configure or modify the impact categories by adding key information about the impact. The following example shows the configuration details of an impact category in an instance. The BCM administrators can configure the following details of a new impact category: Name : Classify the impact of a downtime for your service, process, or applications by adding an appropriate name for the impact such as Legal or Reputational impact. Contributes to : Select whether the impact contributes to recovery time objective or recovery point objective. Applicable timeframes : Set the applicable timeframe for the impact category. Maximum RTO value : Define the maximum RTO value for the impact category. Description : Add description for the impact category. Helper text : Add the helper text that provides a hint to the users on how to respond to the assessment questions. The helper text is then displayed for the user in the business impact analysis record. In the following example, Select an estimated time for each impact level is the helper text for the impact category. ## Impact category configuration by the administrators {#bia-impact-categories__id_vlr_xss_zxb} For more information on how to configure an impact category with the sn_bcm.admin role, see [Configure impact category for BIA](https://www.servicenow.com/docs/LHSwhrS5xQ8yEpkDyfiScQ "Configure an impact category for your business, when you are performing the business impact analysis. Use the Impact Categories module in the Business Continuity Management application navigator to define the name, criteria that the impact category contributes to, applicable timeframes, maximum RTO value, and so on."). ## Impact ratings in BCM {#bia-impact-categories__section_lwj_lhz_fyb} If you have the BCM administrator role, you can view the impact ratings that are installed with demo data and define specific impact ratings in the Impact ratings module. The following example shows the impact ratings that are installed with demo data for an impact category. The impact ratings for an impact category are shown in the following example. ## Configuration of an impact rating {#bia-impact-categories__section_wdw_4hz_fyb} The BCM administrators can configure the following details of an impact rating for the business impact analysis: Name : Assign a unique name to the impact rating. Impact Category : Classify the impact category that the impact rating is associated with. Value : Assign a unique numerical value to each impact rating. The same value can not be reused for any other impact rating in the BCM application. Tolerable : Select the option for enabling the RTO impact as tolerable. This check box appears only if the impact category contributes to the recovery time objective. Description : Add the description about the impact rating. Question text : Revise the question text in the Impact Rating record for the recovery time objective of an impact category. The revised question is then displayed in the RTO assessment form of the business impact analysis record. ## Impact rating configuration by the administrators {#bia-impact-categories__section_f1n_qhz_fyb} For more information on how to configure an impact rating with the sn_bcm.admin role, see [Configure impact ratings](https://www.servicenow.com/docs/cyWk0YKwXtYWf33Ny8kdEg "Configure an impact rating to assess an impact category as low, moderate, high, or critical. Use the Impact Ratings module in the Business Continuity Management application navigator to help you measure the intensity of the loss when a business downtime occurs.").